orchestra/internal/authz/authz_test.go

package authz

import (
	"net/http"
	"net/http/httptest"
	"testing"
	"time"
)

func TestSurfaceCapabilities(t *testing.T) {
	if Telegram.CanEmit("TaskCreated") || Ntfy.CanEmit("ApprovalRequested") {
		t.Fatal("notify surface emitted an event")
	}
	if !TUI.CanEmit("TaskCreated") {
		t.Fatal("control surface cannot emit")
	}
	if !MCP.CanEmit("ApprovalRequested") || MCP.CanEmit("TaskCreated") {
		t.Fatal("mcp gate is wrong")
	}
}

// TestSystemSurfaceDowngradedByHTTPMiddleware guards half of B8: System
// means "the plane itself, in-process" and is always FullControl with no
// token gate, since no deployment configures a token for a surface no HTTP
// caller is meant to use. HTTP() must never let a request pass through
// treated as System, or a caller declaring X-Orchestra-Surface: system gets
// an unconditional, unauthenticated bypass of the token check below it.
// (Downstream handlers must independently avoid re-deriving System from the
// raw header themselves — see cmd/orchestra/main.go's `surface` closure,
// which this package cannot test directly.)
func TestSystemSurfaceDowngradedByHTTPMiddleware(t *testing.T) {
	tokens := map[Surface]string{System: "should-never-be-checked"}
	h := HTTP(tokens, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	req := httptest.NewRequest(http.MethodPost, "/v1/tasks/t1/complete", nil)
	req.Header.Set("X-Orchestra-Surface", "system")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	// System's token check is intentionally skipped by HTTP() (it downgrades
	// to Web before the token comparison), so the request reaching the
	// handler at all is expected here — the guard that matters is that
	// nothing downstream can observe "system" as the resolved surface. This
	// test documents the middleware's half of the fix; main.go's `surface`
	// closure carries the other half.
	if rec.Code != http.StatusOK {
		t.Fatalf("unexpected status %d", rec.Code)
	}
}

// B18: the web UI is a full control plane. A session cookie must be an
// alternative *presentation* of the Web token, never a widening of it.
func TestWebSessionCookieGatesControlPathsOnly(t *testing.T) {
	tokens := map[Surface]string{Web: "secret"}
	sessions := &Sessions{}
	h := HTTPWithSessions(tokens, sessions, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	do := func(method, path string, c *http.Cookie, surface string) int {
		req := httptest.NewRequest(method, path, nil)
		if c != nil {
			req.AddCookie(c)
		}
		if surface != "" {
			req.Header.Set("X-Orchestra-Surface", surface)
		}
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		return rec.Code
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", nil, ""); got != http.StatusUnauthorized {
		t.Fatalf("uncredentialed control path = %d, want 401", got)
	}
	// The SPA shell and the login endpoint must stay reachable, or no
	// browser could ever obtain a cookie in the first place.
	if got := do(http.MethodGet, "/index.html", nil, ""); got != http.StatusOK {
		t.Fatalf("SPA shell = %d, want 200", got)
	}
	if got := do(http.MethodPost, SessionPath, nil, ""); got != http.StatusOK {
		t.Fatalf("login endpoint = %d, want 200", got)
	}
	v, err := sessions.Issue()
	if err != nil {
		t.Fatal(err)
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", &http.Cookie{Name: SessionCookie, Value: v}, ""); got != http.StatusOK {
		t.Fatalf("session-cookie control path = %d, want 200", got)
	}
	if got := do(http.MethodPost, "/v1/ui/tasks", &http.Cookie{Name: SessionCookie, Value: "forged"}, ""); got != http.StatusUnauthorized {
		t.Fatalf("forged cookie = %d, want 401", got)
	}
	// A cookie must not authenticate a non-browser surface.
	tokens[TUI] = "tui-secret"
	if got := do(http.MethodPost, "/v1/tasks", &http.Cookie{Name: SessionCookie, Value: v}, "tui"); got != http.StatusUnauthorized {
		t.Fatalf("cookie on TUI surface = %d, want 401", got)
	}
}

func TestSessionExpires(t *testing.T) {
	s := &Sessions{TTL: time.Millisecond}
	v, err := s.Issue()
	if err != nil {
		t.Fatal(err)
	}
	time.Sleep(5 * time.Millisecond)
	if s.Valid(v) {
		t.Fatal("expired session accepted")
	}
	if s.Valid("") {
		t.Fatal("empty session accepted")
	}
}